| |||||||||||||
|
| |||||||||||||
Wow, some misinformation never dies.Wow, some misinformation never dies.Posted Aug 31, 2006 1:50 UTC (Thu) by corey_s (guest, #12510)In reply to: Wow, some misinformation never dies. by sholdowa Parent article: Gentoo Linux 2006.1 released
> I see, so Gentoo is just the same as all other distros that use yum/rpm,
Apparently you _don't_ see. When learning about a subject which you have
With a binary package management system, such as "yum/rpm or apt/dpkg" -
With a source-based package management system such as gentoo's portage,
Never use gtk or gnome, prefer qt and kde, and only ever script in perl?
USE="-gtk -gnome qt kde perl"
into your portage 'make.conf' config, and _every_ package you ever install
scanner ~ # emerge -s firefox
* www-client/mozilla-firefox
* www-client/mozilla-firefox-bin
scanner ~ # emerge -pv mozilla-firefox
These are the packages that would be merged, in order:
Calculating dependencies... done!
... notice the '-gnome' and '-java', etc for
That means the firefox on this particular system wont build with those
But what happens if I 'emerge' using different USE flags? Let's see:
scanner ~ # USE="gnome java -ipv6" emerge -pv mozilla-firefox
These are the packages that would be merged, in order:
Calculating dependencies... done!
Whoah... completely different result. LOTS AND LOTS of CRAP that my
This translates into better security.
This translates into more simple maintenance.
This translates into better performance.
If security, reliability and performance aren't something you much care
(Log in to post comments)
Minimalist builds untested Posted Aug 31, 2006 3:47 UTC (Thu) by xoddam (subscriber, #2322) [Link] > This translates into better security.
There are two potential schools of thought on this. One is, "deleted code is debugged code". For sure, vulnerabilities which are specific to the subsystems you're not including will not exist in your minimalist build.
But another point is that what you're running is rather different from anything that has had serious production testing by the upstream project or distributors' QA people. It's a product release uniquely made for and by you, and although you might *generally* be able to trust that upstream will ensure that builds with options switched off do basically work, no-one but you can promise that your exact combination is solid and security-hole free. Can you ever be sure that omitting a major component which everyone else uses won't introduce subtle bugs?
Minimalist builds untested Posted Aug 31, 2006 10:46 UTC (Thu) by jimmybgood (guest, #26142) [Link] This is certainly possible, but seems unlikely unless one chooses to build without security features like selinux or privilege seperation. Do you have any examples? Has there been an abiword built the Debian way with four spell checkers and enchant that doesn't have a vulnerability that abiword built with just one spell checker *does* have? Has there been a cairo built with directfb, svga, ggi and aalib support that is more secure than a cairo built only with X support?
By the same token, upgrading in response to a security fix has been known to leave you more vulnerable than before the security fix. But common sense and experience dictate that you will more likely be safe than sorry for upgrading in such a situation.
While I can't be sure that subtle bugs won't be introduced by building with a reduced feature set, I think, with Linux anyway, the less software I have, the safer I am. With OpenBSD, though, I might agree with you. The consideration being the experience and dedication to security of the coder and the rigor with which the code is tested and audited before being released.
Minimalist builds untested Posted Aug 31, 2006 15:01 UTC (Thu) by cventers (subscriber, #31465) [Link] Perhaps, but one thing I find interesting about building your system fromsource (and then prelinking your magic blend) is that it would presumably make things much more difficult for someone that wanted to inject shellcode through an overflow vulnerability. If you want to target a bunch of Linux systems, you can go after a distribution like Red Hat where everyone is running exactly the same binaries.
In a world like Gentoo, though, they're running the same software, but
That doesn't alleviate the problem the way some other solutions (like
Wow, some misinformation never dies. Posted Aug 31, 2006 3:57 UTC (Thu) by sholdowa (guest, #34811) [Link] To quote "It's not about compiler optimization, it's about being able to choose the optimal feature set for your needs."
Now, reread *your* post in the light of that statement, which was the one that *I* was responding to. In which way does gentoo's emerge system differ to yum or apt when choosing feature sets?
See my point now?
Wow, some misinformation never dies. Posted Aug 31, 2006 7:01 UTC (Thu) by flewellyn (subscriber, #5047) [Link] Yes, but it's not a very good one. See, you're missing that many of these packages (especially complex ones like PHP or Apache) have compile-time options that determine what features are built in. If you only use precompiled packages, you can't choose those. This should be readily apparent.
Wow, some misinformation never dies. Posted Aug 31, 2006 21:13 UTC (Thu) by sholdowa (guest, #34811) [Link] Err, no you're pretty much completely wrong there. I see what you're saying, and build my internet facing servers from source for exactly that reason.
My point was that the OP made a sweeping statement that IMHO was almost totally untrue. A package management system is a package management system, is a package management system and the only thing that really makes gentoo's different is the ability/expectation to build from scratch. They're all as good as the data contained within them, and because that's put there by people, they all make mistakes at some time or other.
To address your point, debian allows me to optionally install the following modules for apache 2.0. I could have just as easily used php for an example.
libapache2-mod-annodex - Provides server-side support for Annodex media
|
|
||||||||||||